PT-2015-6790 · Openstack · Openstack Image Service

Eharney + 1 · Publicado 2015-08-19 · Atualizado 2023-02-13 · CVE-2015-5163

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Image Service (Glance) versions 2015.1.x before 2015.1.2 (kilo)

Description The issue allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image when using the V2 API.

Recommendations For OpenStack Image Service (Glance) versions 2015.1.x before 2015.1.2 (kilo), update to version 2015.1.2 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-5163

GHSA-Q73F-VJC2-3GQF

PYSEC-2015-39

RHSA-2015:1639

Produtos afetados

Openstack Image Service

Referências · 17

• https://github.com/openstack/glance · Nota
• https://github.com/openstack/glance/commit/eb99e45829a1b4c93db5692bdbf636a86faa56c4 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2015-39.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5163 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2015-1639.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2015-5163 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-5163 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5163 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-5163 · Aviso do Fabricante
• http://securityfocus.com/bid/76346 · Nota
• https://osv.dev/vulnerability/PYSEC-2015-39 · Aviso do Fabricante
• http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html · Nota
• https://bugs.launchpad.net/glance/+bug/1471912 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1252378 · Nota
• https://web.archive.org/web/20200228024903/http://securityfocus.com/bid/76346 · Nota